<html>
<head><meta charset="utf-8"><title>New lint for deref&#x27;ing NULL pointers · t-lang · Zulip Chat Archive</title></head>
<h2>Stream: <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/index.html">t-lang</a></h2>
<h3>Topic: <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/New.20lint.20for.20deref&#x27;ing.20NULL.20pointers.html">New lint for deref&#x27;ing NULL pointers</a></h3>

<hr>

<base href="https://rust-lang.zulipchat.com">

<head><link href="https://rust-lang.github.io/zulip_archive/style.css" rel="stylesheet"></head>

<a name="233938112"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/New%20lint%20for%20deref%27ing%20NULL%20pointers/near/233938112" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/New.20lint.20for.20deref&#x27;ing.20NULL.20pointers.html#233938112">(Apr 10 2021 at 08:26)</a>:</h4>
<p><a href="https://github.com/rust-lang/rust/pull/83948">https://github.com/rust-lang/rust/pull/83948</a> implements a new lint against deref'ing NULL pointers (because <a href="https://grep.app/search?q=!%20offset_%3Fof&amp;regexp=true&amp;filter[lang][0]=Rust">it seems like people actually do that</a>). as far as I am concerned this is ready (r=me). Is any further process needed because this is a new lint?</p>



<a name="233938133"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/New%20lint%20for%20deref%27ing%20NULL%20pointers/near/233938133" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/New.20lint.20for.20deref&#x27;ing.20NULL.20pointers.html#233938133">(Apr 10 2021 at 08:26)</a>:</h4>
<p>(I first <a href="#narrow/stream/131828-t-compiler/topic/New.20lint.20for.20deref'ing.20a.20NULL.20pointer">posted this in t-compiler</a> but was told lints are more lang team territory)</p>



<a name="233999586"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/New%20lint%20for%20deref%27ing%20NULL%20pointers/near/233999586" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/New.20lint.20for.20deref&#x27;ing.20NULL.20pointers.html#233999586">(Apr 10 2021 at 23:57)</a>:</h4>
<p>hey hey hey, don't put <code>bytemuck</code> in this dubious crowd! We demand an input instance from the invoker, no null pointer deref here.</p>



<a name="234000069"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/New%20lint%20for%20deref%27ing%20NULL%20pointers/near/234000069" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Quy Nguyen <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/New.20lint.20for.20deref&#x27;ing.20NULL.20pointers.html#234000069">(Apr 11 2021 at 00:04)</a>:</h4>
<p><code>offset_of</code> seems to be such a reoccurring problem that we should probably have it in core.</p>



<a name="234003817"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/New%20lint%20for%20deref%27ing%20NULL%20pointers/near/234003817" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/New.20lint.20for.20deref&#x27;ing.20NULL.20pointers.html#234003817">(Apr 11 2021 at 01:11)</a>:</h4>
<p>or in the language...</p>



<a name="234003914"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/New%20lint%20for%20deref%27ing%20NULL%20pointers/near/234003914" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/New.20lint.20for.20deref&#x27;ing.20NULL.20pointers.html#234003914">(Apr 11 2021 at 01:13)</a>:</h4>
<p>It does seem a bit vindictive to be telling all these crates that they have UB while we still don't have a safe alternative. I don't think <code>addr_of!</code> is sufficient as long as <code>addr_of!((*NULL).field)</code> is considered UB</p>



<a name="234031571"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/New%20lint%20for%20deref%27ing%20NULL%20pointers/near/234031571" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/New.20lint.20for.20deref&#x27;ing.20NULL.20pointers.html#234031571">(Apr 11 2021 at 09:42)</a>:</h4>
<p><span class="user-mention silent" data-user-id="224471">Lokathor</span> <a href="#narrow/stream/213817-t-lang/topic/New.20lint.20for.20deref'ing.20NULL.20pointers/near/233999586">said</a>:</p>
<blockquote>
<p>hey hey hey, don't put <code>bytemuck</code> in this dubious crowd! We demand an input instance from the invoker, no null pointer deref here.</p>
</blockquote>
<p>I didn't say <em>all</em> search results of that query were wrong. ;)</p>



<a name="234031593"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/New%20lint%20for%20deref%27ing%20NULL%20pointers/near/234031593" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/New.20lint.20for.20deref&#x27;ing.20NULL.20pointers.html#234031593">(Apr 11 2021 at 09:43)</a>:</h4>
<blockquote>
<p>while we still don't have a safe alternative. </p>
</blockquote>
<p><a href="https://crates.io/crates/memoffset">we do, though</a> -- or what do you mean?<br>
UB doesn't typically have "safe alternatives"...</p>



<a name="234505526"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/New%20lint%20for%20deref%27ing%20NULL%20pointers/near/234505526" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/New.20lint.20for.20deref&#x27;ing.20NULL.20pointers.html#234505526">(Apr 14 2021 at 14:14)</a>:</h4>
<p><span class="user-mention" data-user-id="125270">@scottmcm</span>  so how do we proceed here? does this need FCP or can I r+ the PR?</p>



<a name="234507306"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/New%20lint%20for%20deref%27ing%20NULL%20pointers/near/234507306" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/New.20lint.20for.20deref&#x27;ing.20NULL.20pointers.html#234507306">(Apr 14 2021 at 14:25)</a>:</h4>
<p><span class="user-mention silent" data-user-id="120791">RalfJ</span> <a href="#narrow/stream/213817-t-lang/topic/New.20lint.20for.20deref'ing.20NULL.20pointers/near/234031593">said</a>:</p>
<blockquote>
<blockquote>
<p>while we still don't have a safe alternative. </p>
</blockquote>
<p><a href="https://crates.io/crates/memoffset">we do, though</a> -- or what do you mean?<br>
UB doesn't typically have "safe alternatives"...</p>
</blockquote>
<p>My understanding of the situation was that every existing implementation of <code>offset_of</code> is UB because we don't currently have the means to write it safely. Looking at the <code>memoffset</code> implementation, I think the version with <code>MaybeUninit</code> is safe, because it's actually measuring an allocated object, but I recall there are huge allocations and stack size limitations caused by this approach on debug mode.</p>



<a name="234519852"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/New%20lint%20for%20deref%27ing%20NULL%20pointers/near/234519852" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/New.20lint.20for.20deref&#x27;ing.20NULL.20pointers.html#234519852">(Apr 14 2021 at 15:24)</a>:</h4>
<blockquote>
<p>I recall there are huge allocations and stack size limitations caused by this approach on debug mode.</p>
</blockquote>
<p>Yes, that is the major drawback of this approach.</p>



<a name="234519947"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/New%20lint%20for%20deref%27ing%20NULL%20pointers/near/234519947" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/New.20lint.20for.20deref&#x27;ing.20NULL.20pointers.html#234519947">(Apr 14 2021 at 15:25)</a>:</h4>
<blockquote>
<p>Looking at the memoffset implementation, I think the version with MaybeUninit is safe</p>
</blockquote>
<p>FWIW I think we should call such code <a href="https://rust-lang.github.io/unsafe-code-guidelines/glossary.html#soundness-of-code--of-a-library">"sound"</a>, not "safe", because it <em>does</em> use <code>unsafe</code> code internally so it is not "safe" in the sense of being implemented in safe code.</p>



<a name="234522379"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/New%20lint%20for%20deref%27ing%20NULL%20pointers/near/234522379" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> scottmcm <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/New.20lint.20for.20deref&#x27;ing.20NULL.20pointers.html#234522379">(Apr 14 2021 at 15:39)</a>:</h4>
<p>Sorry, Ralf, I expected us to talk about it in triage yesterday but the triage meeting got cancelled.</p>
<p>The only thing that would come to mind here for me is whether this could happen in unreachable code frequently enough for it to be annoying.  (Perhaps in macros, but this seems like one of those lints that would happen often inside macros, so the usual "just disable it in a macro" is probably not the right choice here.)</p>
<p>Personally, I think it should just go in because it's not a one-way door -- we can always tweak it (behaviour, severity, or even remove it entirely) later if needed, so I don't see a strict need for an FCP.  I'll motion that you can r+ it on my lang member "seems reasonable", the same way unstable library items can go in on a libs member "seems reasonable".</p>
<p>cc <span class="user-group-mention" data-user-group-id="1977">@T-lang</span> in case there are dissenting opinions here.</p>



<a name="234523627"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/New%20lint%20for%20deref%27ing%20NULL%20pointers/near/234523627" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/New.20lint.20for.20deref&#x27;ing.20NULL.20pointers.html#234523627">(Apr 14 2021 at 15:46)</a>:</h4>
<p><span class="user-mention silent" data-user-id="120791">RalfJ</span> <a href="#narrow/stream/213817-t-lang/topic/New.20lint.20for.20deref'ing.20NULL.20pointers/near/234519947">said</a>:</p>
<blockquote>
<blockquote>
<p>Looking at the memoffset implementation, I think the version with MaybeUninit is safe</p>
</blockquote>
<p>FWIW I think we should call such code <a href="https://rust-lang.github.io/unsafe-code-guidelines/glossary.html#soundness-of-code--of-a-library">"sound"</a>, not "safe", because it <em>does</em> use <code>unsafe</code> code internally so it is not "safe" in the sense of being implemented in safe code.</p>
</blockquote>
<p>What term do you use for "this particular line on these inputs is not UB" (i.e. the negation of UB) then? To me "sound" carries the connotation of being defined for all inputs, but UB is a term that applies to particular operations on particular inputs so they aren't appropriate as opposites, and "defined" is kind of ambiguous.</p>



<a name="234523709"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/New%20lint%20for%20deref%27ing%20NULL%20pointers/near/234523709" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/New.20lint.20for.20deref&#x27;ing.20NULL.20pointers.html#234523709">(Apr 14 2021 at 15:46)</a>:</h4>
<blockquote>
<p>(Perhaps in macros, but this seems like one of those lints that would happen often inside macros, so the usual "just disable it in a macro" is probably not the right choice here.)</p>
</blockquote>
<p>I wondered about macros actually, we should potentially enable that "report in external macro" flag... but I think in many cases these will be <em>local</em> macros so I think for now we are good</p>



<a name="234524035"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/New%20lint%20for%20deref%27ing%20NULL%20pointers/near/234524035" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/New.20lint.20for.20deref&#x27;ing.20NULL.20pointers.html#234524035">(Apr 14 2021 at 15:48)</a>:</h4>
<blockquote>
<p>What term do you use for "this particular line on these inputs is not UB" (i.e. the negation of UB) then? To me "sound" carries the connotation of being defined for all inputs, but UB is a term that applies to particular operations on particular inputs so they aren't appropriate as opposites, and "defined" is kind of ambiguous.</p>
</blockquote>
<p>Ah, since you were talking about the macro (and not the macro with some particular) I thought you meant "for all inputs".</p>



<a name="234524170"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/New%20lint%20for%20deref%27ing%20NULL%20pointers/near/234524170" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/New.20lint.20for.20deref&#x27;ing.20NULL.20pointers.html#234524170">(Apr 14 2021 at 15:49)</a>:</h4>
<p>for concrete executions, i.e. when inputs are known, I do indeed sometimes say "safe" though it is annoying that this is ambiguous with "safe code", so I also sometimes say "UB-free" or "well-defined". I wish we had a better positive term for this; then we could even use its negation for UB (which I think is a more helpful mindset when thinking about UB)</p>



<a name="234524540"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/New%20lint%20for%20deref%27ing%20NULL%20pointers/near/234524540" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/New.20lint.20for.20deref&#x27;ing.20NULL.20pointers.html#234524540">(Apr 14 2021 at 15:51)</a>:</h4>
<p>I find it hard to think about macros when talking about abstract inputs, although of course talking about fixed but arbitrary inputs is just linguistic smoke and mirrors for the same thing</p>



<a name="234526668"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/New%20lint%20for%20deref%27ing%20NULL%20pointers/near/234526668" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/New.20lint.20for.20deref&#x27;ing.20NULL.20pointers.html#234526668">(Apr 14 2021 at 16:03)</a>:</h4>
<p>So, if I'm understanding the proposed lint correctly, it <em>just</em> lints when it detects a dereference of a known-to-be-zero pointer?</p>



<a name="234526723"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/New%20lint%20for%20deref%27ing%20NULL%20pointers/near/234526723" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/New.20lint.20for.20deref&#x27;ing.20NULL.20pointers.html#234526723">(Apr 14 2021 at 16:04)</a>:</h4>
<p>With my lang team hat on, that seems completely reasonable to me; I'd even support it being error-by-default rather than warn-by-default.</p>



<a name="234526868"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/New%20lint%20for%20deref%27ing%20NULL%20pointers/near/234526868" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/New.20lint.20for.20deref&#x27;ing.20NULL.20pointers.html#234526868">(Apr 14 2021 at 16:04)</a>:</h4>
<p>It does need to be a lint that people can disable, because on some embedded architectures it may be legitimate to access memory at address 0. (Though I can imagine doing so may take some care to not trip the error paths in any helper functions.)</p>



<a name="234528516"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/New%20lint%20for%20deref%27ing%20NULL%20pointers/near/234528516" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/New.20lint.20for.20deref&#x27;ing.20NULL.20pointers.html#234528516">(Apr 14 2021 at 16:14)</a>:</h4>
<p>actually under rust and llvm rules it's never legitimate to deref 0</p>



<a name="234528552"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/New%20lint%20for%20deref%27ing%20NULL%20pointers/near/234528552" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/New.20lint.20for.20deref&#x27;ing.20NULL.20pointers.html#234528552">(Apr 14 2021 at 16:14)</a>:</h4>
<p>even if 0 is an address on the device, you'd have to use inline asm to do it</p>



<a name="234528793"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/New%20lint%20for%20deref%27ing%20NULL%20pointers/near/234528793" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/New.20lint.20for.20deref&#x27;ing.20NULL.20pointers.html#234528793">(Apr 14 2021 at 16:16)</a>:</h4>
<p>(note: it is <em>possible</em> to make an address other than 0 be the null address in llvm, and then you could deref 0 in that case, but rustc does not do this, so you cannot deref 0)</p>



<a name="234535279"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/New%20lint%20for%20deref%27ing%20NULL%20pointers/near/234535279" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/New.20lint.20for.20deref&#x27;ing.20NULL.20pointers.html#234535279">(Apr 14 2021 at 16:56)</a>:</h4>
<p><span class="user-mention silent" data-user-id="239881">Josh Triplett</span> <a href="#narrow/stream/213817-t-lang/topic/New.20lint.20for.20deref'ing.20NULL.20pointers/near/234526668">said</a>:</p>
<blockquote>
<p>So, if I'm understanding the proposed lint correctly, it <em>just</em> lints when it detects a dereference of a known-to-be-zero pointer?</p>
</blockquote>
<p>yes, but: "dereference" is defined to include <code>addr_of!(*NULL)</code></p>



<a name="234535306"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/New%20lint%20for%20deref%27ing%20NULL%20pointers/near/234535306" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/New.20lint.20for.20deref&#x27;ing.20NULL.20pointers.html#234535306">(Apr 14 2021 at 16:56)</a>:</h4>
<p>...that's unfortunate.</p>



<a name="234535352"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/New%20lint%20for%20deref%27ing%20NULL%20pointers/near/234535352" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/New.20lint.20for.20deref&#x27;ing.20NULL.20pointers.html#234535352">(Apr 14 2021 at 16:57)</a>:</h4>
<p>that was part of the point, since our current UB rules also work that way</p>



<a name="234535361"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/New%20lint%20for%20deref%27ing%20NULL%20pointers/near/234535361" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/New.20lint.20for.20deref&#x27;ing.20NULL.20pointers.html#234535361">(Apr 14 2021 at 16:57)</a>:</h4>
<p>Is that because LLVM defines it as such, and we can't really work around that?</p>



<a name="234535412"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/New%20lint%20for%20deref%27ing%20NULL%20pointers/near/234535412" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/New.20lint.20for.20deref&#x27;ing.20NULL.20pointers.html#234535412">(Apr 14 2021 at 16:57)</a>:</h4>
<p>Or is that because we use gep inbounds, and we'd need a new variant of gep to handle that efficiently?</p>



<a name="234535426"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/New%20lint%20for%20deref%27ing%20NULL%20pointers/near/234535426" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/New.20lint.20for.20deref&#x27;ing.20NULL.20pointers.html#234535426">(Apr 14 2021 at 16:57)</a>:</h4>
<p><span class="user-mention silent" data-user-id="239881">Josh Triplett</span> <a href="#narrow/stream/213817-t-lang/topic/New.20lint.20for.20deref'ing.20NULL.20pointers/near/234526868">said</a>:</p>
<blockquote>
<p>It does need to be a lint that people can disable, because on some embedded architectures it may be legitimate to access memory at address 0. (Though I can imagine doing so may take some care to not trip the error paths in any helper functions.)</p>
</blockquote>
<p>That is something that it'd be nice for Rust to support, but currently it doesn't (there are open issues about this somewhere... EDIT: <a href="https://github.com/rust-lang/unsafe-code-guidelines/issues/29">https://github.com/rust-lang/unsafe-code-guidelines/issues/29</a>)</p>



<a name="234535629"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/New%20lint%20for%20deref%27ing%20NULL%20pointers/near/234535629" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/New.20lint.20for.20deref&#x27;ing.20NULL.20pointers.html#234535629">(Apr 14 2021 at 16:58)</a>:</h4>
<p>Is it legal to use <code>std::ptr::read</code> or <code>std::ptr::write</code> with a NULL?</p>



<a name="234535637"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/New%20lint%20for%20deref%27ing%20NULL%20pointers/near/234535637" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/New.20lint.20for.20deref&#x27;ing.20NULL.20pointers.html#234535637">(Apr 14 2021 at 16:58)</a>:</h4>
<p>Or is that UB as well?</p>



<a name="234535657"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/New%20lint%20for%20deref%27ing%20NULL%20pointers/near/234535657" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/New.20lint.20for.20deref&#x27;ing.20NULL.20pointers.html#234535657">(Apr 14 2021 at 16:59)</a>:</h4>
<p>(ditto the volatile variants)</p>



<a name="234535689"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/New%20lint%20for%20deref%27ing%20NULL%20pointers/near/234535689" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/New.20lint.20for.20deref&#x27;ing.20NULL.20pointers.html#234535689">(Apr 14 2021 at 16:59)</a>:</h4>
<p><span class="user-mention silent" data-user-id="239881">Josh Triplett</span> <a href="#narrow/stream/213817-t-lang/topic/New.20lint.20for.20deref'ing.20NULL.20pointers/near/234535361">said</a>:</p>
<blockquote>
<p>Is that because LLVM defines it as such, and we can't really work around that?</p>
</blockquote>
<p>FYI there was a long discussion about this <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/raw.20ref.20semantics">here on Zulip</a> but it's a bit long to reread^^</p>



<a name="234535750"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/New%20lint%20for%20deref%27ing%20NULL%20pointers/near/234535750" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/New.20lint.20for.20deref&#x27;ing.20NULL.20pointers.html#234535750">(Apr 14 2021 at 16:59)</a>:</h4>
<p>(that was about <code>addr_of!(*NULL)</code>)</p>



<a name="234535866"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/New%20lint%20for%20deref%27ing%20NULL%20pointers/near/234535866" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/New.20lint.20for.20deref&#x27;ing.20NULL.20pointers.html#234535866">(Apr 14 2021 at 17:00)</a>:</h4>
<p>Long-term, I'd love for it to be legal to manipulate NULL pointers as long as the net effect is not a dereference at runtime.</p>



<a name="234535877"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/New%20lint%20for%20deref%27ing%20NULL%20pointers/near/234535877" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/New.20lint.20for.20deref&#x27;ing.20NULL.20pointers.html#234535877">(Apr 14 2021 at 17:00)</a>:</h4>
<p>actually accessing NULL is a rather different topic, I propose not mixing it into this thread but reading <a href="https://github.com/rust-lang/unsafe-code-guidelines/issues/29">https://github.com/rust-lang/unsafe-code-guidelines/issues/29</a> first</p>



<a name="234536067"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/New%20lint%20for%20deref%27ing%20NULL%20pointers/near/234536067" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/New.20lint.20for.20deref&#x27;ing.20NULL.20pointers.html#234536067">(Apr 14 2021 at 17:01)</a>:</h4>
<p>according to the docs in the stdlib, read/write/volatile_op all require a "valid" ptr, and null is never a valid ptr.</p>
<p>and according to core internals, 0 is the null ptr</p>



<a name="234536102"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/New%20lint%20for%20deref%27ing%20NULL%20pointers/near/234536102" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/New.20lint.20for.20deref&#x27;ing.20NULL.20pointers.html#234536102">(Apr 14 2021 at 17:01)</a>:</h4>
<p>as for creating NULL places but not accessing them, like <code>addr_of!(*NULL)</code>, the issue is as follows: the LLVM IR that we generate for <code>addr_of!(*(NULL as *const Struct).field)</code> makes that UB (except when the field has offset 0). The LLVM IR for <code>addr_of!(*NULL)</code> does not. But still, to make the UB rules simpler and since it is easier to relax them than to tighten them, the UB rules currently say that creating a NULL place is UB, which rules out <code>*NULL</code> even in place expression context.</p>



<a name="234536651"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/New%20lint%20for%20deref%27ing%20NULL%20pointers/near/234536651" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/New.20lint.20for.20deref&#x27;ing.20NULL.20pointers.html#234536651">(Apr 14 2021 at 17:04)</a>:</h4>
<p><span class="user-mention silent" data-user-id="239881">Josh Triplett</span> <a href="#narrow/stream/213817-t-lang/topic/New.20lint.20for.20deref'ing.20NULL.20pointers/near/234535306">said</a>:</p>
<blockquote>
<p>...that's unfortunate.</p>
</blockquote>
<p>what is most unfortunate is that "dereference" means different things to different people. :/<br>
<a href="https://doc.rust-lang.org/nightly/reference/expressions/operator-expr.html#the-dereference-operator">The Reference</a> is quite clear that <code>*ptr</code> is a "dereference expression", and this certainly includes its occurrence in <code>addr_of!(*ptr)</code>. But still many people seem to use "dereference" specifically for when memory is actually accessed.</p>



<a name="234541696"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/New%20lint%20for%20deref%27ing%20NULL%20pointers/near/234541696" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/New.20lint.20for.20deref&#x27;ing.20NULL.20pointers.html#234541696">(Apr 14 2021 at 17:36)</a>:</h4>
<p>Myself included, yes. :)</p>



<a name="234640949"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/New%20lint%20for%20deref%27ing%20NULL%20pointers/near/234640949" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/New.20lint.20for.20deref&#x27;ing.20NULL.20pointers.html#234640949">(Apr 15 2021 at 09:04)</a>:</h4>
<p><span class="user-mention" data-user-id="239881">@Josh Triplett</span> what term would you use to refer to <code>*expr</code> expressions in general, disregarding whether they occur in place or value context?</p>



<a name="234641866"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/New%20lint%20for%20deref%27ing%20NULL%20pointers/near/234641866" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jacob Lifshay <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/New.20lint.20for.20deref&#x27;ing.20NULL.20pointers.html#234641866">(Apr 15 2021 at 09:12)</a>:</h4>
<p>prefix-star operator?</p>



<a name="234701422"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/New%20lint%20for%20deref%27ing%20NULL%20pointers/near/234701422" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> cuviper <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/New.20lint.20for.20deref&#x27;ing.20NULL.20pointers.html#234701422">(Apr 15 2021 at 15:45)</a>:</h4>
<p>Maybe it can be qualified either way? e.g. value-deref or place-deref</p>



<a name="234711466"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/New%20lint%20for%20deref%27ing%20NULL%20pointers/near/234711466" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/New.20lint.20for.20deref&#x27;ing.20NULL.20pointers.html#234711466">(Apr 15 2021 at 16:43)</a>:</h4>
<p><span class="user-mention" data-user-id="120791">@RalfJ</span> I would probably just call them something like "star expressions"; I don't know a good general term. If there's precedent from some other language semantics, following precedent is probably a good idea.</p>



<a name="234712040"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/New%20lint%20for%20deref%27ing%20NULL%20pointers/near/234712040" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/New.20lint.20for.20deref&#x27;ing.20NULL.20pointers.html#234712040">(Apr 15 2021 at 16:47)</a>:</h4>
<p>But also, I tend to think of the difference between place or value context as only coming up at the end. I think of it always happening in place terms, and then at the end if you need a value you do any dereferences that remain and weren't cancelled out.</p>



<a name="234929258"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/New%20lint%20for%20deref%27ing%20NULL%20pointers/near/234929258" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/New.20lint.20for.20deref&#x27;ing.20NULL.20pointers.html#234929258">(Apr 16 2021 at 22:15)</a>:</h4>
<p><span class="user-mention silent" data-user-id="239881">Josh Triplett</span> <a href="#narrow/stream/213817-t-lang/topic/New.20lint.20for.20deref'ing.20NULL.20pointers/near/234712040">said</a>:</p>
<blockquote>
<p>But also, I tend to think of the difference between place or value context as only coming up at the end. I think of it always happening in place terms, and then at the end if you need a value you do any dereferences that remain and weren't cancelled out.</p>
</blockquote>
<p>yeah... in terms of formally defining a semantics or implementing it in Miri, "cancelling out" is not a good foundation</p>



<a name="234929322"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/New%20lint%20for%20deref%27ing%20NULL%20pointers/near/234929322" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/New.20lint.20for.20deref&#x27;ing.20NULL.20pointers.html#234929322">(Apr 16 2021 at 22:15)</a>:</h4>
<p>it's much easier when each operator (including <code>*</code> and <code>&amp;</code>) just does a single well-defined thing under all circumstances</p>



<a name="234929686"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/New%20lint%20for%20deref%27ing%20NULL%20pointers/near/234929686" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/New.20lint.20for.20deref&#x27;ing.20NULL.20pointers.html#234929686">(Apr 16 2021 at 22:19)</a>:</h4>
<p><span class="user-mention silent" data-user-id="239881">Josh Triplett</span> <a href="#narrow/stream/213817-t-lang/topic/New.20lint.20for.20deref'ing.20NULL.20pointers/near/234711466">said</a>:</p>
<blockquote>
<p><span class="user-mention silent" data-user-id="120791">RalfJ</span> I would probably just call them something like "star expressions"; I don't know a good general term. If there's precedent from some other language semantics, following precedent is probably a good idea.</p>
</blockquote>
<p>C says</p>
<blockquote>
<p>The unary <code>*</code> operator denotes indirection.</p>
</blockquote>



<a name="234932475"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/New%20lint%20for%20deref%27ing%20NULL%20pointers/near/234932475" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Connor Horman <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/New.20lint.20for.20deref&#x27;ing.20NULL.20pointers.html#234932475">(Apr 16 2021 at 22:50)</a>:</h4>
<p>Indeed. And notably, in C/++, <code>int* i = NULL; (void)*i;</code> is UB even though *i is never read.</p>



<a name="234972691"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/New%20lint%20for%20deref%27ing%20NULL%20pointers/near/234972691" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/New.20lint.20for.20deref&#x27;ing.20NULL.20pointers.html#234972691">(Apr 17 2021 at 08:41)</a>:</h4>
<p><span class="user-mention silent" data-user-id="257758">Connor Horman</span> <a href="#narrow/stream/213817-t-lang/topic/New.20lint.20for.20deref'ing.20NULL.20pointers/near/234932475">said</a>:</p>
<blockquote>
<p>Indeed. And notably, in C/++, <code>int* i = NULL; (void)*i;</code> is UB even though *i is never read.</p>
</blockquote>
<p>so, regarding that... I am very confused by the C standard. It explicitly says (in a non-normative footnote)</p>
<blockquote>
<p>&amp;*E  is equivalent to E (even if E is a null pointer)</p>
</blockquote>
<p>Which IMO quite explicitly says that <code>&amp;*NULL</code> is allowed. This can only be the case if creating a NULL place is allowed. I would thus expected that your example is also allowed (assuming no place-to-value coercion is introduced here, which is my interpretation of your "<code>*i</code> is never read").</p>
<p>However, it also says, in normative text</p>
<blockquote>
<p>If an invalid value has been assigned to the pointer, the behavior of the unary * operator is undefined.</p>
</blockquote>
<p>and then in the same non-normative footnote as above</p>
<blockquote>
<p>Among the invalid values for dereferencing a pointer by the unary * operator are a null pointer,</p>
</blockquote>
<p>I don't know how to make sense of this.</p>



<a name="234974213"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/New%20lint%20for%20deref%27ing%20NULL%20pointers/near/234974213" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/New.20lint.20for.20deref&#x27;ing.20NULL.20pointers.html#234974213">(Apr 17 2021 at 09:10)</a>:</h4>
<p>My understanding of <code>(void)e;</code> is that it is explicitly reading (making an rvalue from) a place, like <code>let _x = *null();</code></p>



<a name="234974441"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/New%20lint%20for%20deref%27ing%20NULL%20pointers/near/234974441" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/New.20lint.20for.20deref&#x27;ing.20NULL.20pointers.html#234974441">(Apr 17 2021 at 09:15)</a>:</h4>
<p>so you are saying what <span class="user-mention" data-user-id="257758">@Connor Horman</span> said is wrong and this <em>does</em> read <code>*i</code> (and that's why it is UB)?</p>



<a name="234974449"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/New%20lint%20for%20deref%27ing%20NULL%20pointers/near/234974449" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/New.20lint.20for.20deref&#x27;ing.20NULL.20pointers.html#234974449">(Apr 17 2021 at 09:15)</a>:</h4>
<p>but that still leaves the problem that the standard seems to contradict itself.^^</p>



<a name="234974552"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/New%20lint%20for%20deref%27ing%20NULL%20pointers/near/234974552" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/New.20lint.20for.20deref&#x27;ing.20NULL.20pointers.html#234974552">(Apr 17 2021 at 09:16)</a>:</h4>
<p><a href="https://timsong-cpp.github.io/cppwp/n4861/expr.static.cast#6">https://timsong-cpp.github.io/cppwp/n4861/expr.static.cast#6</a></p>
<blockquote>
<p>Any expression can be explicitly converted to type cv void, in which case it becomes a discarded-value expression.</p>
</blockquote>
<p><a href="https://timsong-cpp.github.io/cppwp/n4861/expr.prop#expr.context-2">https://timsong-cpp.github.io/cppwp/n4861/expr.prop#expr.context-2</a></p>
<blockquote>
<p>In some contexts, an expression only appears for its side effects. Such an expression is called a discarded-value expression. The array-to-pointer and function-to-pointer standard conversions are not applied. The lvalue-to-rvalue conversion is applied if and only if the expression is a glvalue of volatile-qualified type and it is one of the following:<br>
...</p>
<ul>
<li>indirection,</li>
</ul>
</blockquote>



<a name="234974592"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/New%20lint%20for%20deref%27ing%20NULL%20pointers/near/234974592" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/New.20lint.20for.20deref&#x27;ing.20NULL.20pointers.html#234974592">(Apr 17 2021 at 09:17)</a>:</h4>
<p>So I think this means that lvalue-to-rvalue conversion <em>is</em> applied</p>



<a name="234974597"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/New%20lint%20for%20deref%27ing%20NULL%20pointers/near/234974597" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/New.20lint.20for.20deref&#x27;ing.20NULL.20pointers.html#234974597">(Apr 17 2021 at 09:17)</a>:</h4>
<p>hence <code>(void)*NULL;</code> is UB</p>



<a name="234974650"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/New%20lint%20for%20deref%27ing%20NULL%20pointers/near/234974650" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/New.20lint.20for.20deref&#x27;ing.20NULL.20pointers.html#234974650">(Apr 17 2021 at 09:18)</a>:</h4>
<p>oh wait, it has to be a "glvalue of volatile-qualified type"</p>



<a name="234974661"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/New%20lint%20for%20deref%27ing%20NULL%20pointers/near/234974661" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/New.20lint.20for.20deref&#x27;ing.20NULL.20pointers.html#234974661">(Apr 17 2021 at 09:18)</a>:</h4>
<p>I have no idea if *NULL is one of those things</p>



<a name="234974897"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/New%20lint%20for%20deref%27ing%20NULL%20pointers/near/234974897" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/New.20lint.20for.20deref&#x27;ing.20NULL.20pointers.html#234974897">(Apr 17 2021 at 09:23)</a>:</h4>
<p>okay I think that means it's <code>*ptr</code> where <code>volatile int *ptr;</code> or such</p>



<a name="234974906"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/New%20lint%20for%20deref%27ing%20NULL%20pointers/near/234974906" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/New.20lint.20for.20deref&#x27;ing.20NULL.20pointers.html#234974906">(Apr 17 2021 at 09:23)</a>:</h4>
<p>so that clause doesn't apply</p>



<a name="234975142"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/New%20lint%20for%20deref%27ing%20NULL%20pointers/near/234975142" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/New.20lint.20for.20deref&#x27;ing.20NULL.20pointers.html#234975142">(Apr 17 2021 at 09:28)</a>:</h4>
<p>I can't find any evidence for <span class="user-mention" data-user-id="257758">@Connor Horman</span> 's claim by looking at the standard. It seems like there is no rvalue conversion, and the lvalue <code>*NULL</code> itself is not UB to form, or at least I think so based on related clauses</p>



<a name="234975182"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/New%20lint%20for%20deref%27ing%20NULL%20pointers/near/234975182" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/New.20lint.20for.20deref&#x27;ing.20NULL.20pointers.html#234975182">(Apr 17 2021 at 09:28)</a>:</h4>
<p>Oh goodie, this is an <a href="http://www.open-std.org/jtc1/sc22/wg21/docs/cwg_active.html#232">open issue</a></p>



<a name="234975334"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/New%20lint%20for%20deref%27ing%20NULL%20pointers/near/234975334" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/New.20lint.20for.20deref&#x27;ing.20NULL.20pointers.html#234975334">(Apr 17 2021 at 09:31)</a>:</h4>
<p>(note that you are quoting from the C++ spec above, I was looking at C)</p>



<a name="234975391"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/New%20lint%20for%20deref%27ing%20NULL%20pointers/near/234975391" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/New.20lint.20for.20deref&#x27;ing.20NULL.20pointers.html#234975391">(Apr 17 2021 at 09:32)</a>:</h4>
<p>oh gosh, of course they are different</p>



<a name="234975736"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/New%20lint%20for%20deref%27ing%20NULL%20pointers/near/234975736" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/New.20lint.20for.20deref&#x27;ing.20NULL.20pointers.html#234975736">(Apr 17 2021 at 09:38)</a>:</h4>
<p>I took a look at the C standard where you say, and I also have no idea how to deduce "Thus, &amp;*E is equivalent to E (even if E is a null pointer)" from "If an invalid value has been assigned to the pointer, the behavior of the unary * operator is undefined."</p>



<a name="234976461"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/New%20lint%20for%20deref%27ing%20NULL%20pointers/near/234976461" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/New.20lint.20for.20deref&#x27;ing.20NULL.20pointers.html#234976461">(Apr 17 2021 at 09:52)</a>:</h4>
<p>Also note that the standard uses the verb "dereferencing" here ("Among the invalid values for dereferencing a pointer") which does not appear in the normative paragraph it refers to; I am not sure if this is deliberate (and means something other than "applying the indirection operator") or not.</p>



<a name="234976481"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/New%20lint%20for%20deref%27ing%20NULL%20pointers/near/234976481" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/New.20lint.20for.20deref&#x27;ing.20NULL.20pointers.html#234976481">(Apr 17 2021 at 09:53)</a>:</h4>
<p>this is the <em>only</em> time the string "dereferenc" appears in the standard, except in the glossary where it says "dereference, see indirection operator", so I assume these are meant to be synonyms (Cc <span class="user-mention" data-user-id="239881">@Josh Triplett</span> for precedent for what this term means)</p>



<a name="234977329"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/New%20lint%20for%20deref%27ing%20NULL%20pointers/near/234977329" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/New.20lint.20for.20deref&#x27;ing.20NULL.20pointers.html#234977329">(Apr 17 2021 at 10:08)</a>:</h4>
<p>I think the previous clause 3 is applying:</p>
<blockquote>
<p>The unary <code>&amp;</code> operator yields the address of its operand. ... If the  operand  is  the  result  of  a  unary <code>*</code> operator, neither  that  operator  nor  the <code>&amp;</code> operator  is  evaluated  and  the  result  is  as  if  both  were omitted,  except  that  the  constraints  on  the  operators  still  apply  and  the  result  is  not  an lvalue.</p>
</blockquote>
<p>I think "the constraints on the operators" are the things mentioned in the previous 2 clauses:</p>
<blockquote>
<ul>
<li>The operand of the unary <code>&amp;</code> operator shall be either a function designator, the result of a <code>[]</code> or unary <code>*</code> operator, or an lvalue...</li>
<li>The operand of the unary <code>*</code> operator shall have pointer type.</li>
</ul>
</blockquote>



<a name="234977410"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/New%20lint%20for%20deref%27ing%20NULL%20pointers/near/234977410" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/New.20lint.20for.20deref&#x27;ing.20NULL.20pointers.html#234977410">(Apr 17 2021 at 10:09)</a>:</h4>
<p>That is, clause 3 says that <code>&amp;*NULL</code> doesn't evaluate <code>*NULL</code> as an lvalue (which would be UB) but instead directly returns <code>NULL</code>. But in <code>(void)*NULL;</code> clause 3 doesn't apply, so the result is UB</p>



<a name="234977421"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/New%20lint%20for%20deref%27ing%20NULL%20pointers/near/234977421" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/New.20lint.20for.20deref&#x27;ing.20NULL.20pointers.html#234977421">(Apr 17 2021 at 10:10)</a>:</h4>
<p>non-compositional semantics FTW</p>



<a name="234978331"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/New%20lint%20for%20deref%27ing%20NULL%20pointers/near/234978331" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/New.20lint.20for.20deref&#x27;ing.20NULL.20pointers.html#234978331">(Apr 17 2021 at 10:24)</a>:</h4>
<p><span class="user-mention silent" data-user-id="271719">Mario Carneiro</span> <a href="#narrow/stream/213817-t-lang/topic/New.20lint.20for.20deref'ing.20NULL.20pointers/near/234977421">said</a>:</p>
<blockquote>
<p>non-compositional semantics FTW</p>
</blockquote>
<p>yeah :(</p>



<hr><p>Last updated: Aug 07 2021 at 22:04 UTC</p>
</html>